92a56826e16d643c976834bea529f676c75390cd14a6e53ad599cd824e3756c5

Analysis

max time kernel
15s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 01:01

Target

92a56826e16d643c976834bea529f676c75390cd14a6e53ad599cd824e3756c5.dll
Size

16KB
MD5

10dfdff8898b9dc5be6e6b83525bcacb
SHA1

8f8690ddee1eb16d633b987c080ea6c85745865c
SHA256

92a56826e16d643c976834bea529f676c75390cd14a6e53ad599cd824e3756c5
SHA512

a319ff1ae1322944f3a716d6095902d6c17a369b6dfd1a8257cd543f8312b6a77f94b5405534263b3e30d0b000ed56e436fc8d77ed34ed5e84c263ec88a8b0da
SSDEEP

384:ebPwynYlJiD+UHP+pTDbRV/V228hh4AYqr47tsQy6mMYZrGf:CnCUmpTfRV/V2H34AfLH6mbs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27
PID 780 wrote to memory of 1648	780	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92a56826e16d643c976834bea529f676c75390cd14a6e53ad599cd824e3756c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92a56826e16d643c976834bea529f676c75390cd14a6e53ad599cd824e3756c5.dll,#1
  2⤵
  PID:1648

memory/1648-54-0x0000000000000000-mapping.dmp

Download
memory/1648-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download